{"id":51891936,"url":"https://github.com/datacoves/workshop__snowcap","last_synced_at":"2026-07-26T05:01:31.801Z","repository":{"id":372702924,"uuid":"1308004573","full_name":"datacoves/workshop__snowcap","owner":"datacoves","description":"Sample repository for Snowcap Webinar July 23,2026","archived":false,"fork":false,"pushed_at":"2026-07-22T23:07:02.000Z","size":15,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-22T23:21:01.950Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/datacoves.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-21T18:22:10.000Z","updated_at":"2026-07-22T23:07:16.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/datacoves/workshop__snowcap","commit_stats":null,"previous_names":["datacoves/workshop__snowcap"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/datacoves/workshop__snowcap","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datacoves%2Fworkshop__snowcap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datacoves%2Fworkshop__snowcap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datacoves%2Fworkshop__snowcap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datacoves%2Fworkshop__snowcap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/datacoves","download_url":"https://codeload.github.com/datacoves/workshop__snowcap/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datacoves%2Fworkshop__snowcap/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35901460,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-26T02:00:06.503Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-26T05:01:31.203Z","updated_at":"2026-07-26T05:01:31.787Z","avatar_url":"https://github.com/datacoves.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Webinar - Snowcap\n\n\u003e **Hosted by [Datacoves](https://datacoves.com)** - Enterprise DataOps platform with managed dbt Core and Airflow for data transformation and orchestration.\n\nThis repository contains the materials and code examples from the Datacove **Snowcap** webinar held on **July 23, 2026**.\n\n\u003e 📚 Full documentation for Snowcap is available at [snowcap.datacoves.com](https://snowcap.datacoves.com).\n\n## Overview\n\nThis workshop demonstrates how to manage Snowflake infrastructure as code using **Snowcap**, a Snowflake-native, declarative provisioning\ntool. It walks through defining a database, schemas, and a warehouse in YAML, layering a fine-grained role hierarchy and user grants on top\nof them, then previewing and applying those definitions directly against a Snowflake account.\n\n## Project Structure\n\n### 📁 `/resources`\nContains the YAML resource definitions that make up the Snowcap configuration:\n- **`warehouses.yml`** - Declares the `warehouses` list variable used by the warehouse object template (currently `wh_transforming`, x-small, auto-suspend after 60s)\n- **`databases.yml`** - Declares the `analytics` database, the `z_db__analytics` role, and its USAGE grant\n- **`schemas.yml`** - Declares the `analytics.staging` and `analytics.marts` schemas plus the fine-grained `z_schemas__usage__*`\nand `z_tables_views__select__analytics` roles/grants for accessing them\n- **`roles__functional.yml`** - Functional roles (`analyst`, `reporter`) and the role hierarchy that composes the fine-grained `z_*` roles into each one\n- **`users.yml`** - Declares users `fmercado` and `gomezn` and grants them `ACCOUNTADMIN`, `ORGADMIN`, `ANALYST`, and `REPORTER`\n\n### 📁 `/resources/object_templates`\nReusable Snowcap templates that use `for_each` over variables to generate resources, roles, and grants consistently:\n- **`warehouse.yml`** - Creates a warehouse, a matching `z_wh__\u003cname\u003e` role, and USAGE/MONITOR grants for each entry in `var.warehouses`\n\n### 📁 Root Files\n- **`plan.sh`** - Loads `.env` and runs `snowcap plan`, showing what would change without applying it\n- **`apply.sh`** - Loads `.env` and runs `snowcap apply`, applying the resource definitions to the target Snowflake account\n- **`.env.sample`** - Template for the environment variables required to connect to Snowflake\n- **`snowcap_test.sql`** - Sample worksheet for verifying access: switches to the `analyst` and `reporter` roles and queries the\n`analytics.staging`/`analytics.marts` schemas to confirm the granted access works as expected\n\n## Key Features Demonstrated\n\n### 1. Snowflake Infrastructure as Code\n- Declarative YAML definitions for warehouses, roles, users, and grants\n- No state file to manage - Snowcap reads the current state directly from Snowflake\n- `snowcap plan` to preview changes and `snowcap apply` to execute them\n\n### 2. Reusable Templates with `for_each`\n- The warehouse object template iterates over the `var.warehouses` list variable\n- It consistently generates the warehouse plus a matching `z_wh__\u003cname\u003e` access-control role and grant\n- Adding a new warehouse is as simple as adding an entry to the `warehouses` vars list\n\n### 3. Role-Based Access Control Pattern\n- Fine-grained `z_`-prefixed roles scoped to a single privilege/object (e.g. `z_db__analytics`, `z_wh__wh_transforming`,\n`z_schemas__usage__marts`, `z_tables_views__select__analytics`)\n- These fine-grained roles and their grants are defined alongside the resources they protect (`databases.yml`, `schemas.yml`,\n`object_templates/warehouse.yml`)\n- Functional roles (`roles__functional.yml`) compose the fine-grained roles into roles a human user is actually granted\n(`analyst`, `reporter`) - `analyst` gets usage on all schemas, `reporter` is scoped to just `marts`\n\n\n## Getting Started\n\n### Prerequisites\n- A Snowflake account with permissions to create databases, schemas, warehouses, roles, and users (e.g. `SECURITYADMIN`)\n- `uv`/`uvx` installed (Snowcap is run via `uvx`, no separate install required)\n- A key-pair authentication key configured for your Snowflake user\n\n### Setup Instructions\n\n1. **Configure Environment**\n   ```bash\n   cp .env.sample .env\n   # Fill in SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, SNOWFLAKE_ROLE, SNOWFLAKE_PRIVATE_KEY_PATH\n   # (SNOWFLAKE_ACCOUNT_PII and SNOWFLAKE_PASSWORD are optional/unused with key-pair auth)\n   ```\n\n2. **Preview Changes**\n   ```bash\n   ./plan.sh\n   ```\n\n3. **Apply Changes**\n   ```bash\n   ./apply.sh\n   ```\n\n## Workshop Scenarios\n\nThe workshop walks through several scenarios:\n\n1. **Basic Setup**: Defining a database, its schemas, and a warehouse in YAML, alongside the fine-grained access-control roles/grants for each\n2. **Role Hierarchy**: Building fine-grained (`z_*`) roles bottom-up into functional roles (`analyst`, `reporter`) that users are actually granted\n3. **Templated Resources**: Using a `for_each` object template to add new warehouses without duplicating boilerplate\n4. **Plan vs Apply**: Comparing `snowcap plan` output against `snowcap apply` to understand exactly what changes before they happen\n5. **Verifying Access**: Using `snowcap_test.sql` to confirm the `analyst` and `reporter` roles can actually query the schemas they were granted\n\n## Configuration Notes\n\n- **Sync Resources**: `plan.sh`/`apply.sh` pass `--sync_resources role,grant,role_grant,warehouse,user` so Snowcap reconciles (and removes) resources of those types no longer defined in YAML, not just adds new ones\n- **Unsynced Types**: `database` and `schema` are intentionally left out of `--sync_resources`, so Snowcap will create/update them but won't drop a database or schema just because it's removed from YAML\n- **Templates**: The `object_templates/warehouse.yml` template is driven by the `var.warehouses` variable defined in `resources/warehouses.yml`\n\n## Workshop Takeaways\n\n- Snowflake infrastructure and access control can be declared and version-controlled the same way application code is\n- Object templates + variables keep role/grant boilerplate DRY as new resources are added\n- A layered role hierarchy (fine-grained `z_*` roles → functional roles) scales access control cleanly as teams grow\n- `snowcap plan` makes infrastructure changes reviewable before they touch a live account\n\n---\n\n*This repository serves as a reference implementation for the concepts covered in the Snowcap webinar. Feel free to explore the code and adapt it for your own use cases.*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatacoves%2Fworkshop__snowcap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdatacoves%2Fworkshop__snowcap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatacoves%2Fworkshop__snowcap/lists"}